CVE-2020-12062

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2020-12062
The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client's download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that "this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol" and "utimes does not fail under normal circumstances.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://github.com/openssh/openssh-portable/commit/955854cafca88e0cdcd3d09ca1ad4ada465364a1 Patch Third Party Advisory
https://github.com/openssh/openssh-portable/commit/aad87b88fc2536b1ea023213729aaf4eaabe1894 Third Party Advisory
https://www.openssh.com/txt/release-8.3 Release Notes Vendor Advisory
https://www.openwall.com/lists/oss-security/2020/05/27/1 Mailing List Release Notes Third Party Advisory
https://github.com/openssh/openssh-portable/commit/955854cafca88e0cdcd3d09ca1ad4ada465364a1 Patch Third Party Advisory
https://github.com/openssh/openssh-portable/commit/aad87b88fc2536b1ea023213729aaf4eaabe1894 Third Party Advisory
https://www.openssh.com/txt/release-8.3 Release Notes Vendor Advisory
https://www.openwall.com/lists/oss-security/2020/05/27/1 Mailing List Release Notes Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:openbsd:openssh:8.2:*:*:*:*:*:*:*
History

21 Nov 2024, 04:59

Type Values Removed Values Added
References () https://github.com/openssh/openssh-portable/commit/955854cafca88e0cdcd3d09ca1ad4ada465364a1 - Patch, Third Party Advisory () https://github.com/openssh/openssh-portable/commit/955854cafca88e0cdcd3d09ca1ad4ada465364a1 - Patch, Third Party Advisory
References () https://github.com/openssh/openssh-portable/commit/aad87b88fc2536b1ea023213729aaf4eaabe1894 - Third Party Advisory () https://github.com/openssh/openssh-portable/commit/aad87b88fc2536b1ea023213729aaf4eaabe1894 - Third Party Advisory
References () https://www.openssh.com/txt/release-8.3 - Release Notes, Vendor Advisory () https://www.openssh.com/txt/release-8.3 - Release Notes, Vendor Advisory
References () https://www.openwall.com/lists/oss-security/2020/05/27/1 - Mailing List, Release Notes, Third Party Advisory () https://www.openwall.com/lists/oss-security/2020/05/27/1 - Mailing List, Release Notes, Third Party Advisory

07 Nov 2023, 03:15

Type Values Removed Values Added
Summary ** DISPUTED ** The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client's download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that "this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol" and "utimes does not fail under normal circumstances." The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client's download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that "this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol" and "utimes does not fail under normal circumstances.
Information

Published : 2020-06-01 16:15

Updated : 2024-11-21 04:59

NVD link : CVE-2020-12062

Mitre link : CVE-2020-12062

CVE.ORG link : CVE-2020-12062

JSON object : View

Products Affected

openbsd

  • openssh
CWE
CWE-20

Improper Input Validation